The Problem With Bare Hashes
If everyone hashes passwords the same way, identical passwords produce identical hashes, and attackers precompute giant rainbow tables mapping common passwords to their hashes.
Salting
A salt is a unique random value stored alongside each hash and mixed into the input. Because each user gets a different salt:
- Identical passwords hash to different values.
- Precomputed tables become useless, since they would need a table per salt.
- The salt is not secret, only unique.
Peppering
A pepper is a single secret value added to every password before hashing, but kept outside the database, often in application config or a hardware module. If the database leaks but the pepper does not, the stolen hashes are far harder to crack.
Using Both
Modern password functions handle the salt for you. The pepper is an extra defense in depth, valuable only if it is stored separately from the hashes.
Key idea
A unique per user salt defeats rainbow tables by making identical passwords hash differently, while a separately stored secret pepper adds defense in depth if the database alone is stolen.